

<!DOCTYPE html>
<html lang="zh-CN" data-default-color-scheme=auto>



<head>
  <meta charset="UTF-8">
  <link rel="apple-touch-icon" sizes="76x76" href="/img/favicon.png">
  <link rel="icon" href="/img/favicon.png">
  <meta name="viewport" content="width=device-width, initial-scale=1.0, maximum-scale=5.0, shrink-to-fit=no">
  <meta http-equiv="x-ua-compatible" content="ie=edge">
  
  <meta name="theme-color" content="#2f4154">
  <meta name="author" content="MiaoHao-oops">
  <meta name="keywords" content="">
  
    <meta name="description" content="本文提出了 bpftime，一个*用户态的 eBPF 运行时环境*，用于 uprobe，syscall hook 和内核-用户通信，获得了 10x 的性能提升。">
<meta property="og:type" content="article">
<meta property="og:title" content="文献阅读: bpftime: userspace eBPF Runtime for Uprobe, Syscall and Kernel-User Interactions">
<meta property="og:url" content="http://miaohao-oops.github.io/2024/03/06/%E6%96%87%E7%8C%AE%E9%98%85%E8%AF%BB-bpftime-userspace-eBPF-Runtime-for-Uprobe-Syscall-and-Kernel-User-Interactions/index.html">
<meta property="og:site_name" content="Miao&#39;s Blog">
<meta property="og:description" content="本文提出了 bpftime，一个*用户态的 eBPF 运行时环境*，用于 uprobe，syscall hook 和内核-用户通信，获得了 10x 的性能提升。">
<meta property="og:locale" content="zh_CN">
<meta property="og:image" content="http://miaohao-oops.github.io/img/The-Workflow-of-kernel-eBPF-runtime.png">
<meta property="og:image" content="http://miaohao-oops.github.io/img/The-Workflow-of-user-eBPF-runtime.png">
<meta property="article:published_time" content="2024-03-06T11:59:37.000Z">
<meta property="article:modified_time" content="2024-03-11T07:08:24.712Z">
<meta property="article:author" content="MiaoHao-oops">
<meta property="article:tag" content="paper">
<meta property="article:tag" content="ebpf">
<meta name="twitter:card" content="summary_large_image">
<meta name="twitter:image" content="http://miaohao-oops.github.io/img/The-Workflow-of-kernel-eBPF-runtime.png">
  
  
  <title>文献阅读: bpftime: userspace eBPF Runtime for Uprobe, Syscall and Kernel-User Interactions - Miao&#39;s Blog</title>

  <link  rel="stylesheet" href="https://cdn.jsdelivr.net/npm/bootstrap@4/dist/css/bootstrap.min.css" />


  <link  rel="stylesheet" href="https://cdn.jsdelivr.net/npm/github-markdown-css@4/github-markdown.min.css" />
  <link  rel="stylesheet" href="https://cdn.jsdelivr.net/npm/hint.css@2/hint.min.css" />

  
    
    
      
      <link  rel="stylesheet" href="https://cdn.jsdelivr.net/npm/highlight.js@10/styles/github-gist.min.css" />
    
  

  
    <link  rel="stylesheet" href="https://cdn.jsdelivr.net/npm/@fancyapps/fancybox@3/dist/jquery.fancybox.min.css" />
  


<!-- 主题依赖的图标库，不要自行修改 -->

<link rel="stylesheet" href="//at.alicdn.com/t/font_1749284_ba1fz6golrf.css">



<link rel="stylesheet" href="//at.alicdn.com/t/font_1736178_lbnruvf0jn.css">


<link  rel="stylesheet" href="/css/main.css" />

<!-- 自定义样式保持在最底部 -->


  <script id="fluid-configs">
    var Fluid = window.Fluid || {};
    var CONFIG = {"hostname":"miaohao-oops.github.io","root":"/","version":"1.8.14","typing":{"enable":true,"typeSpeed":70,"cursorChar":"_","loop":false},"anchorjs":{"enable":true,"element":"h1,h2,h3,h4,h5,h6","placement":"right","visible":"hover","icon":""},"progressbar":{"enable":true,"height_px":3,"color":"#29d","options":{"showSpinner":false,"trickleSpeed":100}},"copy_btn":true,"image_zoom":{"enable":true,"img_url_replace":["",""]},"toc":{"enable":true,"headingSelector":"h1,h2,h3,h4,h5,h6","collapseDepth":0},"lazyload":{"enable":true,"loading_img":"/img/loading.gif","onlypost":false,"offset_factor":2},"web_analytics":{"enable":true,"baidu":null,"google":null,"gtag":null,"tencent":{"sid":null,"cid":null},"woyaola":null,"cnzz":null,"leancloud":{"appId":"y7tlaLEOoW5C1xBYm8VBo64Q-gzGzoHsz","appKey":"F7gylUefEEtQk24FEbvgfnBi","server_url":"https://y7tlaleo.lc-cn-n1-shared.com","path":"window.location.pathname","ignore_local":true}},"search_path":"/local-search.xml"};
  </script>
  <script  src="/js/utils.js" ></script>
  <script  src="/js/color-schema.js" ></script>
<meta name="generator" content="Hexo 6.0.0"><link rel="alternate" href="/atom.xml" title="Miao's Blog" type="application/atom+xml">
</head>


<body>
  <header style="height: 70vh;">
    <nav id="navbar" class="navbar fixed-top  navbar-expand-lg navbar-dark scrolling-navbar">
  <div class="container">
    <a class="navbar-brand" href="/">
      <strong>MiaoHao-oops</strong>
    </a>

    <button id="navbar-toggler-btn" class="navbar-toggler" type="button" data-toggle="collapse"
            data-target="#navbarSupportedContent"
            aria-controls="navbarSupportedContent" aria-expanded="false" aria-label="Toggle navigation">
      <div class="animated-icon"><span></span><span></span><span></span></div>
    </button>

    <!-- Collapsible content -->
    <div class="collapse navbar-collapse" id="navbarSupportedContent">
      <ul class="navbar-nav ml-auto text-center">
        
          
          
          
          
            <li class="nav-item">
              <a class="nav-link" href="/">
                <i class="iconfont icon-home-fill"></i>
                首页
              </a>
            </li>
          
        
          
          
          
          
            <li class="nav-item">
              <a class="nav-link" href="/archives/">
                <i class="iconfont icon-archive-fill"></i>
                归档
              </a>
            </li>
          
        
          
          
          
          
            <li class="nav-item">
              <a class="nav-link" href="/categories/">
                <i class="iconfont icon-category-fill"></i>
                分类
              </a>
            </li>
          
        
          
          
          
          
            <li class="nav-item">
              <a class="nav-link" href="/tags/">
                <i class="iconfont icon-tags-fill"></i>
                标签
              </a>
            </li>
          
        
          
          
          
          
            <li class="nav-item">
              <a class="nav-link" href="/about/">
                <i class="iconfont icon-user-fill"></i>
                关于
              </a>
            </li>
          
        
        
          <li class="nav-item" id="search-btn">
            <a class="nav-link" target="_self" href="javascript:;" data-toggle="modal" data-target="#modalSearch" aria-label="Search">
              &nbsp;<i class="iconfont icon-search"></i>&nbsp;
            </a>
          </li>
        
        
          <li class="nav-item" id="color-toggle-btn">
            <a class="nav-link" target="_self" href="javascript:;" aria-label="Color Toggle">&nbsp;<i
                class="iconfont icon-dark" id="color-toggle-icon"></i>&nbsp;</a>
          </li>
        
      </ul>
    </div>
  </div>
</nav>

    <div class="banner" id="banner" parallax=true
         style="background: url('/img/default.png') no-repeat center center;
           background-size: cover;">
      <div class="full-bg-img">
        <div class="mask flex-center" style="background-color: rgba(0, 0, 0, 0.3)">
          <div class="page-header text-center fade-in-up">
            <span class="h2" id="subtitle" title="文献阅读: bpftime: userspace eBPF Runtime for Uprobe, Syscall and Kernel-User Interactions">
              
            </span>

            
              <div class="mt-3">
  
  
    <span class="post-meta">
      <i class="iconfont icon-date-fill" aria-hidden="true"></i>
      <time datetime="2024-03-06 19:59" pubdate>
        2024年3月6日 晚上
      </time>
    </span>
  
</div>

<div class="mt-1">
  
    <span class="post-meta mr-2">
      <i class="iconfont icon-chart"></i>
      2.1k 字
    </span>
  

  
    <span class="post-meta mr-2">
      <i class="iconfont icon-clock-fill"></i>
      
      
      18 分钟
    </span>
  

  
  
    
      <!-- LeanCloud 统计文章PV -->
      <span id="leancloud-page-views-container" class="post-meta" style="display: none">
        <i class="iconfont icon-eye" aria-hidden="true"></i>
        <span id="leancloud-page-views"></span> 次
      </span>
    
  
</div>

            
          </div>

          
        </div>
      </div>
    </div>
  </header>

  <main>
    
      

<div class="container-fluid nopadding-x">
  <div class="row nomargin-x">
    <div class="d-none d-lg-block col-lg-2"></div>
    <div class="col-lg-8 nopadding-x-md">
      <div class="container nopadding-x-md" id="board-ctn">
        <div class="py-5" id="board">
          <article class="post-content mx-auto">
            <!-- SEO header -->
            <h1 style="display: none">文献阅读: bpftime: userspace eBPF Runtime for Uprobe, Syscall and Kernel-User Interactions</h1>
            
            <div class="markdown-body">
              <h1
id="bpftime-userspace-ebpf-runtime-for-uprobe-syscall-and-kernel-user-interactions">bpftime:
userspace eBPF Runtime for Uprobe, Syscall and Kernel-User
Interactions</h1>
<blockquote>
<p>论文作者：Yusheng Zheng, Tong Yu, Yiwei Yang, Yanpeng Hu, Xiaozheng
Lai, Andrew Quinn</p>
<p>发表期刊：arXiv preprint arXiv:2311.07923</p>
<p>发表时间：December 2023</p>
</blockquote>
<h2 id="what">What</h2>
<p>本文提出了 bpftime，一个<em>用户态的 eBPF 运行时环境</em>，用于
uprobe，syscall hook 和内核-用户通信。基于 bpftime 的 uprobe 获得了 10
倍的性能提升。此外，bpftime 还充分考虑了和 eBPF 生态的兼容性，原有的
eBPF 工具链仍然可以在该项目中继续使用，为 eBPF 开发者带来的便利。</p>
<p>bpftime 的特点：</p>
<ul>
<li>High-Performance, general-purpose Userspace eBPF Runtime
compatibility with existing eBPF echosystem：在实现传统 eBPF
用户态功能的基础上实现与现有 eBPF 生态兼容</li>
<li>Programmatic attaching mechanism and Seamless Runtime Injection for
userspace eBPF：ebftime
可以在<em>无需重新编译、无需重新运行</em>的条件下，实现动态插装、注入</li>
<li>Working together with kernel eBPF and Extensible Feature
Set：实现了与 kernel eBPF 协同工作</li>
</ul>
<h2 id="why">Why</h2>
<p>下图为 kernel eBPF 的工作流：</p>
<p><img src="/img/The-Workflow-of-kernel-eBPF-runtime.png" srcset="/img/loading.gif" lazyload /></p>
<p>传统的 eBPF 面临着性能和安全的双挑战：</p>
<ul>
<li><p>性能上，与 Uprobe 相关的上下文切换开销降低了性能</p>
<p>当使用 eBPF 挂载到 uprobe
事件时，若用户态程序执行到勘测函数，则将陷入内核，运行 eBPF
程序，发生<em>第一次上下文切换</em>。</p>
<p>eBPF
运行完毕后，从内核态返回，发生<em>第二次上下文切换</em>。</p></li>
<li><p>安全上，eBPF 所要求的特权访问增加了攻击面，如 container
escapes、kernel exploits</p>
<p>eBPF 运行需要 root
权限，且它的运行时建立在内核空间，因此增加了攻击面。如果 kernel eBPF
运行时出了问题，那么内核将处于一种危险状态，影响整个系统。</p></li>
</ul>
<p>但 eBPF &amp; uprobe
被广泛应用<sup id="fnref:1"><a href="#fn:1" rel="footnote">1</a></sup>：</p>
<ul>
<li>用户空间协议追踪：SSL、TLS、HTTP2</li>
<li>内存分配、泄露监控</li>
<li>等等</li>
</ul>
<h2 id="how">How</h2>
<p>下图为 user eBPF
的工作流<sup id="fnref:2"><a href="#fn:2" rel="footnote">2</a></sup>：</p>
<p><img src="/img/The-Workflow-of-user-eBPF-runtime.png" srcset="/img/loading.gif" lazyload /></p>
<p>bpftime 的核心机制是将<em>没必要在 kernel space
执行的操作提取出来，放到 user space
执行</em>，从而减少了上下文切换次数。实际上，减少上下文切换次数是操作系统性能优化的一个主要方法。</p>
<p>实现策略包括：</p>
<ul>
<li><em>bpf 系统调用捕获</em>：通过 bpftime-syscall.so 捕获传统 eBPF
程序中 bpf 相关系统调用，将其转换为用户空间操作</li>
<li><em>共享内存</em>：通过共享内存的方式将 eBPF 字节码载入并创建 eBPF
maps，于内核实现交互</li>
<li><em><code>ptrace</code>/<code>LD_PRELOAD</code></em>：实现动态注入，增强了
bpftime 使用的灵活性</li>
<li><em>动态链接</em>：bpftime 本质上实现了 2 个库 bpftime-syscall.so 和
bpftime-agent.so，动态链接技术为 bpftime 的无缝插装提供了可能</li>
<li>“JIT compilation”：即时翻译技术使得 bpftime
运行时可以动态修改进程代码，从而实现 function/syscall hook</li>
</ul>
<p>对于 uprobe
而言，这种机制能够减少上下文切换次数，从而提升性能；而对于 syscall
hook，由于 syscall
本身就需要陷入内核，因此对性能影响不大。这一点在后面的性能测试中也得到了体现。</p>
<h2 id="test">Test</h2>
<h3 id="performance">Performance</h3>
<p>作者运行了 micro-benchmarks 用于性能测试：</p>
<p><img
src="/img/Perfoemance-comparison-of-kernel-and-userspace-probes.png" srcset="/img/loading.gif" lazyload /></p>
<p>从结果来看，uprobe 性能获得了 10x 的提升，而 syscall hook
的性能反而下降了，但是在可接受范围内。</p>
<p>结论：用户态 uprobe 性能获得了显著的提升，可以作为内核态 uprobe
的替代。</p>
<h3 id="runtime-efficiency">Runtime Efficiency</h3>
<p>这一部分测试了在不同使用场景下 bpftime LLVM JIT 其他用户态 eBPF
运行时、本地代码以及 WASM
的效率，为不同场景下的运行时选择提供了参考。</p>
<p>测试表明，bpftime LLVM JIT
在整数运算和复杂数学操作场景下性能表现优异。</p>
<h3 id="compatibility">Compatibility</h3>
<p>这一部分对 bpftime 进行了兼容性分析，方法为将真实世界采用 bcc 开发的
eBPF 程序运行时更换为 bpftime。</p>
<p>结果表明原有的 eBPF 程序可以将运行时无缝迁移到 bpftime
上，并且功能是等效的。</p>
<div id="footnotes">
<hr>
<div id="footnotelist">
<ol style="list-style:none; padding-left: 0;">
<li id="fn:1">
<span
style="display: inline-block; vertical-align: top; padding-right: 10px;">1.</span><span
style="display: inline-block; vertical-align: top;">https://github.com/plctlab/PLCT-Open-Reports/blob/master/slides/20230929-yunwei-bpftime-userspace-ebpf.pdf</span><a href="#fnref:1" rev="footnote">
↩︎</a>
</li>
<li id="fn:2">
<span
style="display: inline-block; vertical-align: top; padding-right: 10px;">2.</span><span
style="display: inline-block; vertical-align: top;">文章中的图片标题有误，应为“The
Workflow of <em>user</em> eBPF
runtime”</span><a href="#fnref:2" rev="footnote"> ↩︎</a>
</li>
</ol>
</div>
</div>

            </div>
            <hr>
            <div>
              <div class="post-metas mb-3">
                
                  <div class="post-meta mr-3">
                    <i class="iconfont icon-category"></i>
                    
                      <a class="hover-with-bg" href="/categories/note/">note</a>
                    
                  </div>
                
                
                  <div class="post-meta">
                    <i class="iconfont icon-tags"></i>
                    
                      <a class="hover-with-bg" href="/tags/paper/">paper</a>
                    
                      <a class="hover-with-bg" href="/tags/ebpf/">ebpf</a>
                    
                  </div>
                
              </div>
              
                <p class="note note-warning">
                  
                    本博客所有文章除特别声明外，均采用 <a target="_blank" href="https://creativecommons.org/licenses/by-sa/4.0/deed.zh" rel="nofollow noopener noopener">CC BY-SA 4.0 协议</a> ，转载请注明出处！
                  
                </p>
              
              
                <div class="post-prevnext">
                  <article class="post-prev col-6">
                    
                    
                      <a href="/2024/03/10/%E6%96%87%E7%8C%AE%E9%98%85%E8%AF%BB-To-FUSE-or-Not-to-FUSE-Performance-of-User-Space-File-Systems/">
                        <i class="iconfont icon-arrowleft"></i>
                        <span class="hidden-mobile">文献阅读: To FUSE or Not to FUSE: Performance of User-Space File Systems</span>
                        <span class="visible-mobile">上一篇</span>
                      </a>
                    
                  </article>
                  <article class="post-next col-6">
                    
                    
                      <a href="/2024/03/05/%E6%96%87%E7%8C%AE%E9%98%85%E8%AF%BB-The-BSD-Packet-Filter-A-New-Architecture-for-User-level-Packet-Capture/">
                        <span class="hidden-mobile">文献阅读: The BSD Packet Filter: A New Architecture for User-level Packet Capture</span>
                        <span class="visible-mobile">下一篇</span>
                        <i class="iconfont icon-arrowright"></i>
                      </a>
                    
                  </article>
                </div>
              
            </div>

            
              <!-- Comments -->
              <article class="comments" id="comments" lazyload>
                
                  
                
                
  <div id="valine"></div>
  <script type="text/javascript">
    Fluid.utils.loadComments('#valine', function() {
      Fluid.utils.createScript('https://cdn.jsdelivr.net/npm/valine@1/dist/Valine.min.js', function() {
        var options = Object.assign(
          {"appId":"y7tlaLEOoW5C1xBYm8VBo64Q-gzGzoHsz","appKey":"F7gylUefEEtQk24FEbvgfnBi","path":"window.location.pathname","placeholder":"此处留言","avatar":"retro","meta":["nick","mail","link"],"requiredFields":[],"pageSize":10,"lang":"zh-CN","highlight":false,"recordIP":false,"serverURLs":"","emojiCDN":null,"emojiMaps":null,"enableQQ":false},
          {
            el: "#valine",
            path: window.location.pathname
          }
        )
        new Valine(options);
        Fluid.utils.waitElementVisible('#valine .vcontent', () => {
          Fluid.plugins.initFancyBox('#valine .vcontent img:not(.vemoji)');
        })
      });
    });
  </script>
  <noscript>Please enable JavaScript to view the comments</noscript>


              </article>
            
          </article>
        </div>
      </div>
    </div>
    
      <div class="d-none d-lg-block col-lg-2 toc-container" id="toc-ctn">
        <div id="toc">
  <p class="toc-header"><i class="iconfont icon-list"></i>&nbsp;目录</p>
  <div class="toc-body" id="toc-body"></div>
</div>

      </div>
    
  </div>
</div>

<!-- Custom -->


    

    
      <a id="scroll-top-button" aria-label="TOP" href="#" role="button">
        <i class="iconfont icon-arrowup" aria-hidden="true"></i>
      </a>
    

    
      <div class="modal fade" id="modalSearch" tabindex="-1" role="dialog" aria-labelledby="ModalLabel"
     aria-hidden="true">
  <div class="modal-dialog modal-dialog-scrollable modal-lg" role="document">
    <div class="modal-content">
      <div class="modal-header text-center">
        <h4 class="modal-title w-100 font-weight-bold">搜索</h4>
        <button type="button" id="local-search-close" class="close" data-dismiss="modal" aria-label="Close">
          <span aria-hidden="true">&times;</span>
        </button>
      </div>
      <div class="modal-body mx-3">
        <div class="md-form mb-5">
          <input type="text" id="local-search-input" class="form-control validate">
          <label data-error="x" data-success="v"
                 for="local-search-input">关键词</label>
        </div>
        <div class="list-group" id="local-search-result"></div>
      </div>
    </div>
  </div>
</div>
    

    
  </main>

  <footer class="text-center mt-5 py-3">
  <div class="footer-content">
     <a href="https://hexo.io" target="_blank" rel="nofollow noopener"><span>Hexo</span></a> && <a href="https://github.com/fluid-dev/hexo-theme-fluid" target="_blank" rel="nofollow noopener"><span>Fluid</span></a> 
  </div>
  
  <div class="statistics">
    
    

    
      
        <!-- LeanCloud 统计PV -->
        <span id="leancloud-site-pv-container" style="display: none">
            总访问量 
            <span id="leancloud-site-pv"></span>
             次
          </span>
      
      
        <!-- LeanCloud 统计UV -->
        <span id="leancloud-site-uv-container" style="display: none">
            总访客数 
            <span id="leancloud-site-uv"></span>
             人
          </span>
      

    
  </div>


  

  
</footer>


  <!-- SCRIPTS -->
  
  <script  src="https://cdn.jsdelivr.net/npm/nprogress@0/nprogress.min.js" ></script>
  <link  rel="stylesheet" href="https://cdn.jsdelivr.net/npm/nprogress@0/nprogress.min.css" />

  <script>
    NProgress.configure({"showSpinner":false,"trickleSpeed":100})
    NProgress.start()
    window.addEventListener('load', function() {
      NProgress.done();
    })
  </script>


<script  src="https://cdn.jsdelivr.net/npm/jquery@3/dist/jquery.min.js" ></script>
<script  src="https://cdn.jsdelivr.net/npm/bootstrap@4/dist/js/bootstrap.min.js" ></script>
<script  src="/js/events.js" ></script>
<script  src="/js/plugins.js" ></script>

<!-- Plugins -->


  <script  src="/js/local-search.js" ></script>



  
    <script  src="/js/img-lazyload.js" ></script>
  



  



  
    <script  src="https://cdn.jsdelivr.net/npm/tocbot@4/dist/tocbot.min.js" ></script>
  
  
    <script  src="https://cdn.jsdelivr.net/npm/@fancyapps/fancybox@3/dist/jquery.fancybox.min.js" ></script>
  
  
    <script  src="https://cdn.jsdelivr.net/npm/anchor-js@4/anchor.min.js" ></script>
  
  
    <script defer src="https://cdn.jsdelivr.net/npm/clipboard@2/dist/clipboard.min.js" ></script>
  






  <script  src="https://cdn.jsdelivr.net/npm/typed.js@2/lib/typed.min.js" ></script>
  <script>
    (function (window, document) {
      var typing = Fluid.plugins.typing;
      var title = document.getElementById('subtitle').title;
      
        typing(title);
      
    })(window, document);
  </script>












  

  

  

  

  

  





<!-- 主题的启动项 保持在最底部 -->
<script  src="/js/boot.js" ></script>


<script type="text/x-mathjax-config">
    MathJax.Hub.Config({
        tex2jax: {
            inlineMath: [ ["$","$"], ["\\(","\\)"] ],
            skipTags: ['script', 'noscript', 'style', 'textarea', 'pre', 'code'],
            processEscapes: true
        }
    });
    MathJax.Hub.Queue(function() {
        var all = MathJax.Hub.getAllJax();
        for (var i = 0; i < all.length; ++i)
            all[i].SourceElement().parentNode.className += ' has-jax';
    });
</script>
<script src="http://cdn.mathjax.org/mathjax/latest/MathJax.js?config=TeX-AMS-MML_HTMLorMML"></script>
</body>
</html>
